Security audit

Nonblocking Tasks

Security checks for vulnerabilities and agentic risk

Overview

This skill has an understandable task-management goal, but it asks for broad automatic background execution, persistent agent-rule changes, and cross-channel conversation recall that users should review carefully before installing.

Install only if you intentionally want global nonblocking behavior with recurring background checks. Before installing, confirm how to disable the cron monitor, inspect changes to AGENTS.md and MEMORY.md, decide whether task details may be stored in active_tasks.md, and avoid enabling cross-channel recall in shared or sensitive workspaces unless explicit consent and channel boundaries are enforced.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The README states that installation automatically creates persistent artifacts and a scheduled monitor, which exceeds a simple task-management description and introduces host-level persistence. Even if intended for functionality, installing monitoring files and cron jobs without prominent consent or clear scope can surprise users and create an unnecessary foothold for ongoing execution.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Automatically installing a cron-based monitor gives the skill recurring execution on the host, which is a persistence mechanism with elevated security significance. In the context of an agent skill, this is more dangerous because background execution can continue outside the user's immediate awareness and could be repurposed for unintended actions if the skill or its environment is compromised.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill is presented as a non-blocking task manager, but it also instructs the agent to read cross-channel conversation history from a local global store and inject that content into the current context. That behavior is not necessary for task scheduling and creates an unnecessary privacy boundary break, enabling exposure of data from other sessions or channels.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The documented behavior directly accesses per-user conversation logs under a shared local history path for a feature unrelated to task non-blocking. Reading another channel's logs can disclose sensitive prompts, credentials, or business data and risks mixing records between users if identity mapping is weak or absent.

Intent-Code Divergence

Medium

Confidence: 76% confidence
Finding: The claim that the mechanism applies to all channels and all users broadens the operational scope far beyond a single session. In context, that broad scope makes later cross-channel retrieval more dangerous because it normalizes applying the skill across unrelated user and channel boundaries.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README omits a prominent warning that installation changes local configuration and enables scheduled background monitoring, preventing informed user consent. This is especially concerning here because the skill is marketed as a responsiveness aid, while the disclosed behavior includes persistent state and recurring background activity that materially changes the host environment.

Vague Triggers

High

Confidence: 94% confidence
Finding: Activating on any user message is overly broad and causes the skill to run automatically without meaningful user intent. Because the skill also performs file modification, cron setup, and possible data recall, this trigger can cause intrusive side effects from ordinary conversation.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Automatic first-conversation configuration lacks strong constraints, so the first ordinary message after install can trigger workspace changes and scheduled tasks. This increases the chance of silent, unexpected persistence and configuration drift without informed approval.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The cross-channel trigger phrases are common conversational expressions like '刚才说过' or '你还记得', making the recall behavior easy to activate unintentionally. Given that activation leads to reading historical conversation data, the ambiguous boundary materially increases privacy risk.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill directs automatic modification of workspace files and creation of a cron job without clear risk disclosure or explicit permission. These are persistent side effects that can alter agent behavior over time and create ongoing execution paths outside the current interaction.

Missing User Warnings

High

Confidence: 98% confidence
Finding: Reading conversation records from another channel has clear privacy implications, but the skill does not adequately warn the user or obtain specific consent for that access. This can expose sensitive content from past interactions and surprise users who did not expect cross-session correlation.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: Defining the skill as applicable to all channels and all users removes important scope boundaries and encourages broad application without user choice. In practice, this increases the blast radius of any misconfiguration, data access mistake, or persistence mechanism introduced by the skill.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill instructs the system to read and inject another channel's same-day conversation content into the current session. That is a direct cross-session data exposure risk at the natural-language layer, where secrets or sensitive context can be surfaced to an unintended channel or participant.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The skill persistently modifies AGENTS.md and MEMORY.md and stores task remarks in active_tasks.md, creating durable instructions and summaries derived from user interactions. This can unintentionally retain sensitive task content and influence future agent behavior beyond the original request.

Static analysis

No suspicious patterns detected.